Key points
- CVE-2026-110310 affects Amazon S3 Encryption Client for .NET versions 2.1.0 and later, including specific 3.x and 4.x releases.
- Attackers with read access to encrypted objects can alter metadata to force a downgrade to vulnerable PKCS#1 v1.5 padding.
- Patches are available for versions 3.x and 4.x; users of versions 1.x and 2.x must migrate to newer supported releases.
Amazon S3 Encryption Client for .NET versions 2.1.0 and higher contain a vulnerability identified as CVE-2026-110310. This flaw allows remote users with read access to encrypted objects in an S3 bucket to decrypt those objects. The issue stems from the client's handling of legacy envelope key formats. Specifically, an attacker can modify the padding scheme recorded in an object’s metadata to use the older PKCS#1 v1.5 standard. Because this padding scheme is susceptible to the Bleichenbacher attack, the manipulation enables the recovery of the RSA-wrapped envelope key, resulting in full data decryption.
In plain English
The encryption client relies on a specific method to wrap and protect keys. The vulnerability exists because the software does not strictly enforce the use of modern, secure padding standards when processing object metadata. An attacker who can view the encrypted files can change a small piece of information—the metadata—to tell the client to use an older, weaker protection method. This older method has known weaknesses that allow attackers to reverse-engineer the key, effectively unlocking the data without needing the original encryption credentials.
The background
AWS published security bulletin 2026-135-AWS on October 14, 2026, to address this issue. The bulletin classifies the content as important, requiring attention from users of the affected software. The impacted versions include all releases from 2.1.0 upwards, specifically versions 3.0.0 through 3.2.1 and 4.0.0 through 4.0.2. The vendor notes that the 1.x and 2.x lines will not receive patches for this vulnerability. Users of those older branches are required to migrate to version 3.2.2 or 4.0.3 to resolve the security gap.
What changes now
AWS has released patches for the affected major versions. Customers using version 3.x should upgrade to version 3.2.2, while those on version 4.x must move to version 4.0.3. The vendor advises ensuring that any forked or derivative code incorporates these new fixes. Organizations relying on the unsupported 1.x or 2.x lines must plan a migration path to the patched 3.x or 4.x versions immediately, as no further fixes will be issued for those legacy branches.
Who needs to act first
Security operations teams should prioritize updating systems that expose encrypted objects to external or semi-trusted users. Begin by identifying which applications use the vulnerable .NET client versions in production environments. Test the upgrade in a non-production environment first to ensure compatibility with existing data workflows. Back up critical configuration settings before applying the patch. For systems where immediate updates are not possible, restrict read access to encrypted objects to only essential internal accounts, reducing the attack surface while migration plans are executed.
What to do and how to stay safe: AWS
- Audit all applications using the Amazon S3 Encryption Client for .NET to identify installed versions and compare them against the impacted list.
- Upgrade to version 3.2.2 or 4.0.3 as soon as possible, ensuring any custom forks include the vendor's security fixes.
- Restrict read permissions on S3 buckets containing encrypted objects to limit the ability of potential attackers to manipulate metadata.
- Monitor access logs for unusual metadata modifications or repeated failed decryption attempts that may indicate exploitation attempts.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the S3 Encryption Client for .NET are affected?
Versions 2.1.0 and later are affected, including 3.0.0 to 3.2.1 and 4.0.0 to 4.0.2.
Is there a patch available for version 2.x?
No, the 1.x and 2.x lines will not receive patches; users must migrate to version 3.2.2 or 4.0.3.
What is the CVE ID for this vulnerability?
The vulnerability is identified as CVE-2026-110310.
